lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

libertas: fix invalid access

Browse Source 
card->priv must not be accessed after lbs_remove_card() was called
as lbs_remove_card() frees card->priv via free_netdev().

For libertas_sdio this is a regression introduced by 23b149c189.
The correct fix to the issue described there is simply to remove the
assignment. This flag is set at the appropriate time inside
lbs_remove_card anyway.

Reported-by: Daniel Drake <dsd@laptop.org>
Signed-off-by: Sven Neumann <s.neumann@raumfeld.com>
Signed-off-by: Daniel Drake <dsd@laptop.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Sven Neumann
2010-11-24 16:02:00 +00:00
committed by John W. Linville
parent 517ff43146
commit 16ccdf0dbc
2 changed files with 0 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/net/wireless/libertas/if_sdio.c
View File

@@ -1170,7 +1170,6 @@ static void if_sdio_remove(struct sdio_func *func)
lbs_deb_sdio("call remove card\n"); lbs_deb_sdio("call remove card\n");
lbs_stop_card(card->priv); lbs_stop_card(card->priv);
lbs_remove_card(card->priv); lbs_remove_card(card->priv);
card->priv->surpriseremoved = 1;
flush_workqueue(card->workqueue); flush_workqueue(card->workqueue);
destroy_workqueue(card->workqueue); destroy_workqueue(card->workqueue);

1
drivers/net/wireless/libertas/if_spi.c
View File

@@ -1055,7 +1055,6 @@ static int __devexit libertas_spi_remove(struct spi_device *spi)
lbs_stop_card(priv); lbs_stop_card(priv);
lbs_remove_card(priv); /* will call free_netdev */ lbs_remove_card(priv); /* will call free_netdev */
priv->surpriseremoved = 1;
free_irq(spi->irq, card); free_irq(spi->irq, card);
if_spi_terminate_spi_thread(card); if_spi_terminate_spi_thread(card);
if (card->pdata->teardown) if (card->pdata->teardown)